look for rootsh, it's in the fedora repo so for RHEL it might be there
or in the EPEL repo.

Cheers,
Harry
Manuel Aróstegui wrote:

El dom, 12-07-2009 a las 23:36 +0300, a bv escribió:

Hi,
I have some RHEL 5,4,3, boxes which some priviledged users (who can
sudo) exits. Cause all can sudo, have the same rights, its sometimes
who doess what on the system (sometimes strange thinhgs happen, the
daeomons stop etc.) . So how can i monitor the system who does what on
it , not only talking about securing it.

What about logging their shell? Doing that you'd be able to know which
commands the user ran.
Manuel.